getsentry / getsentry/sentry-ruby

RealIp does not account for clients on intranet

オープン
#2,592 コメント 1 件 リアクション 0 件 担当者 1 名 @sl0thentr0py が担当を希望しています GitHub で見る
Improvement Ruby
主要言語
Ruby
スター
987
フォーク
541
平均マージ
17時間 40分
マージ済み PR(30日)
19

説明

### Issue Description

sentry-ruby/lib/sentry/utils/real_ip.rb - Sentry::Utils::RealIp.initialize prepends a list of standard local and private IP blocks (LOCAL_ADDRESSES) to the supplied trusted_proxies.

The combined list is later used to determine the client's real IP by eliminating trusted proxies.

When hosting on a cloud provider and accessing from a client behind a firewall, this is fine - "user" will be the client's firewall LAN IP.

However, if hosting on the same LAN as the client, the client's IP will be filtered out. It's possible all candidate IPs will be filtered out in some situations.

### Reproduction Steps

Set up a Rails app server, a reverse proxy, and a client all on the same LAN using one of the standard private CIDR blocks.

Configure the Rails app with sentry-rails and set and set config.action_dispatch.trusted_proxies to include only the IP of the reverse proxy.

### Expected Behavior

The same behavior as Rails 7.1: If config.action_dispatch.trusted_proxies is set, the default list is replaced.

This allows the app to be more selective in which IPs it discards when choosing what IP to report as the client's.

(Note: config.action_dispatch.trusted_proxies now only accepts enumerable and always replaces the hard coded default.)

### Actual Behavior

Sentry::Utils::RealIp.initialize will be called with the list of trusted_proxies from the ActionDispatch configuration, but these will be supplemented by the static LOCAL_ADDRESSES.

Since all LAN IPs will be matched by that list, Sentry will not see the client's real IP.

### Ruby Version

3.1.6

### SDK Version

5.19

### Integration and Its Version

Rails

### Sentry Config

The only relevant setting: send_default_pii = true

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。